Password Generator & The Math Behind Security

🧮How Are Random Passwords Generated?

Strong password security starts with true randomness. If a password can be predicted, it can be cracked. That's why our generator uses the Web Crypto API—a cryptographically secure random number generator built into all modern browsers and based on open standards.

• Step 1: You choose the password length and which character types to include (letters, numbers, symbols).
• Step 2: For each character, the Web Crypto API generates a random number, like rolling a perfectly fair dice with as many sides as there are possible characters.
• Step 3: Each random number is mapped to a character, and all are joined together to form your password.

Key Point: Your password is generated instantly, right in your browser. It is never sent over the internet or stored anywhere—only you see it. This approach is safer than server-side generation, as it eliminates the risk of interception or logging.

The Web Crypto API is supported by all major browsers and is the industry standard for secure random number generation on the web.

Technical Explanation: Mathematical Model of Password Generation

Let’s formalize the process mathematically, as in a technical mathematics or computer science course:

• Alphabet: Let \( \mathcal{A} \) be the set of possible characters (e.g., 72 symbols: A-Z, a-z, 0-9, special characters).
• Password Length: Let \( L \) be the desired password length.
• Random Variables: For each position \( i \in \{1, 2, \ldots, L\} \), define a discrete random variable \( X_i \) that takes values in \( \mathcal{A} \).
• Uniform Distribution: Each \( X_i \) is sampled independently and uniformly: \( P(X_i = a) = 1/|\mathcal{A}| \) for all \( a \in \mathcal{A} \).
• Independence: The random variables \( X_1, X_2, \ldots, X_L \) are independent: knowing one gives no information about the others.
• Password as a Random Vector: The generated password is the vector \( (X_1, X_2, \ldots, X_L) \).

Space of Possible Passwords: The total number of possible passwords is \( |\mathcal{A}|^L \). Each password is equally likely.

Entropy Calculation: The Shannon entropy of the password is \( H = L \cdot \log_2(|\mathcal{A}|) \) bits. This quantifies unpredictability and is a direct measure of password strength.

Cryptographic Security: The Web Crypto API uses a cryptographically secure pseudorandom number generator (CSPRNG), designed to be unpredictable even to attackers with significant computational resources. This is essential: if the random numbers were predictable, the effective password space would be much smaller in practice.

Summary: In mathematical terms, secure password generation is modeled as sampling a random vector of length \( L \) from the uniform distribution over \( \mathcal{A}^L \), using a CSPRNG to ensure true unpredictability.

💪What Makes a Password Strong?

It's all about combinations and randomness. The more possible combinations, the harder it is for hackers to guess your password—even with supercomputers!

How Do We Calculate Combinations?

Imagine you have a password of length L, and you can use N different characters (like A-Z, a-z, 0-9, and symbols). The total number of possible passwords is:

For example, if you use 26 lowercase letters and your password is 4 characters long:

But if you use uppercase, lowercase, numbers, and 10 symbols (72 characters total) and your password is 8 characters:

Table: How Combinations Grow

📊What is Entropy?

Entropy is a fancy word for "unpredictability". In passwords, it's measured in bits. More bits = more security.

The formula is:

For example, an 8-character password using 72 possible characters:

⏳How Long Would It Take to Crack?

Let's say a hacker can try 1 billion (1,000,000,000) passwords per second. For a password with 49 bits of entropy (like above):

But if your password is 12 characters with symbols (entropy ≈ 74 bits):

❓FAQ: Password Math